]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/modrdn.c
To conform to the SLAPI spec, slapi_filter_get_ava() should not duplicate
[openldap] / servers / slapd / modrdn.c
index 15f88529ea0bf105720bddd1f8df5b8528d7a42c..5bb70711828ec0c68ef933606ebaf62be7828c61 100644 (file)
@@ -1,6 +1,6 @@
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 /*
@@ -29,6 +29,7 @@
  */
 
 #include "portable.h"
+#include "slapi_common.h"
 
 #include <stdio.h>
 
@@ -37,6 +38,7 @@
 
 #include "ldap_pvt.h"
 #include "slap.h"
+#include "slapi.h"
 
 int
 do_modrdn(
@@ -49,13 +51,13 @@ do_modrdn(
        struct berval newSuperior = { 0, NULL };
        ber_int_t       deloldrdn;
 
-       struct berval *pdn = NULL;
-       struct berval *pnewrdn = NULL;
-       struct berval *pnewSuperior = NULL;
+       struct berval pdn = { 0, NULL };
+       struct berval pnewrdn = { 0, NULL };
+       struct berval pnewSuperior = { 0, NULL }, *pnewS = NULL;
 
-       struct berval *ndn = NULL;
-       struct berval *nnewrdn = NULL;
-       struct berval *nnewSuperior = NULL;
+       struct berval ndn = { 0, NULL };
+       struct berval nnewrdn = { 0, NULL };
+       struct berval nnewSuperior = { 0, NULL }, *nnewS = NULL;
 
        Backend *be;
        Backend *newSuperior_be = NULL;
@@ -64,9 +66,10 @@ do_modrdn(
        const char *text;
        int manageDSAit;
 
+       Slapi_PBlock *pb = op->o_pb;
+
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-               "do_modrdn: begin\n" ));
+       LDAP_LOG( OPERATION, ENTRY, "do_modrdn: begin\n", 0, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "do_modrdn\n", 0, 0, 0 );
 #endif
@@ -83,12 +86,11 @@ do_modrdn(
         *      }
         */
 
-       if ( ber_scanf( op->o_ber, "{oob", &dn, &newrdn, &deloldrdn )
+       if ( ber_scanf( op->o_ber, "{mmb", &dn, &newrdn, &deloldrdn )
            == LBER_ERROR )
        {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                       "do_modrdn: ber_scanf failed\n" ));
+               LDAP_LOG( OPERATION, ERR, "do_modrdn: ber_scanf failed\n", 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "ber_scanf failed\n", 0, 0, 0 );
 #endif
@@ -106,8 +108,8 @@ do_modrdn(
                         * newSuperior is present: report error.
                         */
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                               "do_modrdn: (v2) invalid field newSuperior.\n" ));
+                       LDAP_LOG( OPERATION, ERR,
+                               "do_modrdn: (v2) invalid field newSuperior.\n", 0, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY,
                            "modrdn(v2): invalid field newSuperior!\n",
@@ -120,14 +122,14 @@ do_modrdn(
                        goto cleanup;
                }
 
-               if ( ber_scanf( op->o_ber, "o", &newSuperior ) 
+               if ( ber_scanf( op->o_ber, "m", &newSuperior ) 
                     == LBER_ERROR ) {
 
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                               "do_modrdn: ber_scanf(\"a\") failed\n" ));
+                       LDAP_LOG( OPERATION, ERR,
+                               "do_modrdn: ber_scanf(\"m\") failed\n", 0, 0, 0 );
 #else
-                       Debug( LDAP_DEBUG_ANY, "ber_scanf(\"a\") failed\n",
+                       Debug( LDAP_DEBUG_ANY, "ber_scanf(\"m\") failed\n",
                                0, 0, 0 );
 #endif
 
@@ -136,13 +138,15 @@ do_modrdn(
                        rc = SLAPD_DISCONNECT;
                        goto cleanup;
                }
+               pnewS = &pnewSuperior;
+               nnewS = &nnewSuperior;
        }
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ARGS,
+       LDAP_LOG( OPERATION, ARGS, 
                "do_modrdn: dn (%s) newrdn (%s) newsuperior(%s)\n",
                dn.bv_val, newrdn.bv_val,
-               newSuperior.bv_len ? newSuperior.bv_val : "" ));
+               newSuperior.bv_len ? newSuperior.bv_val : "" );
 #else
        Debug( LDAP_DEBUG_ARGS,
            "do_modrdn: dn (%s) newrdn (%s) newsuperior (%s)\n",
@@ -152,8 +156,7 @@ do_modrdn(
 
        if ( ber_scanf( op->o_ber, /*{*/ "}") == LBER_ERROR ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                       "do_modrdn: ber_scanf failed\n" ));
+               LDAP_LOG( OPERATION, ERR, "do_modrdn: ber_scanf failed\n", 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "do_modrdn: ber_scanf failed\n", 0, 0, 0 );
 #endif
@@ -166,8 +169,7 @@ do_modrdn(
 
        if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                       "do_modrdn: get_ctrls failed\n" ));
+               LDAP_LOG( OPERATION, ERR, "do_modrdn: get_ctrls failed\n", 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "do_modrdn: get_ctrls failed\n", 0, 0, 0 );
 #endif
@@ -176,12 +178,12 @@ do_modrdn(
                goto cleanup;
        } 
 
-       rc = dnPretty( NULL, &dn, &pdn );
+       rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn );
        if( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+               LDAP_LOG( OPERATION, INFO, 
                        "do_modrdn: conn %d  invalid dn (%s)\n",
-                       conn->c_connid, dn.bv_val ));
+                       conn->c_connid, dn.bv_val, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
                        "do_modrdn: invalid dn (%s)\n", dn.bv_val, 0, 0 );
@@ -191,25 +193,10 @@ do_modrdn(
                goto cleanup;
        }
 
-       rc = dnNormalize( NULL, &dn, &ndn );
-       if( rc != LDAP_SUCCESS ) {
-#ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                       "do_modrdn: conn %d  invalid dn (%s)\n",
-                       conn->c_connid, pdn->bv_val ));
-#else
-               Debug( LDAP_DEBUG_ANY,
-                       "do_modrdn: invalid dn (%s)\n", pdn->bv_val, 0, 0 );
-#endif
-               send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
-                   "invalid DN", NULL, NULL );
-               goto cleanup;
-       }
-
-       if( ndn->bv_len == 0 ) {
+       if( ndn.bv_len == 0 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "do_modrdn:  attempt to modify root DSE.\n" ));
+               LDAP_LOG( OPERATION, ERR,
+                       "do_modrdn:  attempt to modify root DSE.\n", 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "do_modrdn: root dse!\n", 0, 0, 0 );
 #endif
@@ -218,29 +205,29 @@ do_modrdn(
                        NULL, "cannot rename the root DSE", NULL, NULL );
                goto cleanup;
 
-#ifdef SLAPD_SCHEMA_DN
-       } else if ( strcasecmp( ndn->bv_val, SLAPD_SCHEMA_DN ) == 0 ) {
+       } else if ( bvmatch( &ndn, &global_schemandn ) ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                       "do_modrdn: attempt to modify subschema subentry\n" ));
+               LDAP_LOG( OPERATION, ERR,
+                       "do_modrdn: attempt to modify subschema subentry: %s (%ld)\n",
+                       global_schemandn.bv_val, (long) global_schemandn.bv_len, 0 );
 #else
-               Debug( LDAP_DEBUG_ANY, "do_modrdn: subschema subentry!\n", 0, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "do_modrdn: subschema subentry: %s (%ld)\n",
+                       global_schemandn.bv_val, (long) global_schemandn.bv_len, 0 );
 #endif
 
                send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
                        NULL, "cannot rename subschema subentry", NULL, NULL );
                goto cleanup;
-#endif
        }
 
        /* FIXME: should have/use rdnPretty / rdnNormalize routines */
 
-       rc = dnPretty( NULL, &newrdn, &pnewrdn );
+       rc = dnPrettyNormal( NULL, &newrdn, &pnewrdn, &nnewrdn );
        if( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+               LDAP_LOG( OPERATION, INFO, 
                        "do_modrdn: conn %d  invalid newrdn (%s)\n",
-                       conn->c_connid, newrdn.bv_val ));
+                       conn->c_connid, newrdn.bv_val, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
                        "do_modrdn: invalid newrdn (%s)\n", newrdn.bv_val, 0, 0 );
@@ -250,28 +237,13 @@ do_modrdn(
                goto cleanup;
        }
 
-       rc = dnNormalize( NULL, &newrdn, &nnewrdn );
-       if( rc != LDAP_SUCCESS ) {
-#ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                       "do_modrdn: conn %d  invalid newrdn (%s)\n",
-                       conn->c_connid, pnewrdn->bv_val ));
-#else
-               Debug( LDAP_DEBUG_ANY,
-                       "do_modrdn: invalid newrdn (%s)\n", pnewrdn->bv_val, 0, 0 );
-#endif
-               send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
-                   "invalid new RDN", NULL, NULL );
-               goto cleanup;
-       }
-
-       if( !nnewrdn->bv_len || !rdn_validate( pnewrdn->bv_val ) ) {
+       if( rdnValidate( &pnewrdn ) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                       "do_modrdn: invalid rdn (%s).\n", pnewrdn->bv_val ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "do_modrdn: invalid rdn (%s).\n", pnewrdn.bv_val, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "do_modrdn: invalid rdn (%s)\n",
-                       pnewrdn->bv_val, 0, 0 );
+                       pnewrdn.bv_val, 0, 0 );
 #endif
 
                send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
@@ -279,33 +251,18 @@ do_modrdn(
                goto cleanup;
        }
 
-       if( newSuperior.bv_len ) {
-               rc = dnPretty( NULL, &newSuperior, &pnewSuperior );
+       if( pnewS ) {
+               rc = dnPrettyNormal( NULL, &newSuperior, &pnewSuperior,
+                       &nnewSuperior );
                if( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
+                       LDAP_LOG( OPERATION, INFO, 
                                "do_modrdn: conn %d  invalid newSuperior (%s)\n",
-                               conn->c_connid, newSuperior.bv_val ));
+                               conn->c_connid, newSuperior.bv_val, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY,
                                "do_modrdn: invalid newSuperior (%s)\n",
                                newSuperior.bv_val, 0, 0 );
-#endif
-                       send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
-                               "invalid newSuperior", NULL, NULL );
-                       goto cleanup;
-               }
-
-               rc = dnNormalize( NULL, &newSuperior, &nnewSuperior );
-               if( rc != LDAP_SUCCESS ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                               "do_modrdn: conn %d  invalid newSuperior (%s)\n",
-                               conn->c_connid, pnewSuperior->bv_val ));
-#else
-                       Debug( LDAP_DEBUG_ANY,
-                               "do_modrdn: invalid newSuperior (%s)\n",
-                               pnewSuperior->bv_val, 0, 0 );
 #endif
                        send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
                                "invalid newSuperior", NULL, NULL );
@@ -313,8 +270,8 @@ do_modrdn(
                }
        }
 
-       Statslog( LDAP_DEBUG_STATS, "conn=%ld op=%d MODRDN dn=\"%s\"\n",
-           op->o_connid, op->o_opid, pdn->bv_val, 0, 0 );
+       Statslog( LDAP_DEBUG_STATS, "conn=%lu op=%lu MODRDN dn=\"%s\"\n",
+           op->o_connid, op->o_opid, pdn.bv_val, 0, 0 );
 
        manageDSAit = get_manageDSAit( op );
 
@@ -323,14 +280,14 @@ do_modrdn(
         * appropriate one, or send a referral to our "referral server"
         * if we don't hold it.
         */
-       if ( (be = select_backend( ndn, manageDSAit, 0 )) == NULL ) {
-               struct berval **ref = referral_rewrite( default_referral,
-                       NULL, dn.bv_val, LDAP_SCOPE_DEFAULT );
+       if ( (be = select_backend( &ndn, manageDSAit, 0 )) == NULL ) {
+               BerVarray ref = referral_rewrite( default_referral,
+                       NULL, &pdn, LDAP_SCOPE_DEFAULT );
 
                send_ldap_result( conn, op, rc = LDAP_REFERRAL,
                        NULL, NULL, ref ? ref : default_referral, NULL );
 
-               ber_bvecfree( ref );
+               ber_bvarray_free( ref );
                goto cleanup;
        }
 
@@ -343,7 +300,7 @@ do_modrdn(
        }
 
        /* check for referrals */
-       rc = backend_check_referrals( be, conn, op, pdn->bv_val, ndn->bv_val );
+       rc = backend_check_referrals( be, conn, op, &pdn, &ndn );
        if ( rc != LDAP_SUCCESS ) {
                goto cleanup;
        }
@@ -351,8 +308,8 @@ do_modrdn(
        /* Make sure that the entry being changed and the newSuperior are in 
         * the same backend, otherwise we return an error.
         */
-       if( newSuperior.bv_len ) {
-               newSuperior_be = select_backend( nnewSuperior, 0, 0 );
+       if( pnewS ) {
+               newSuperior_be = select_backend( &nnewSuperior, 0, 0 );
 
                if ( newSuperior_be != be ) {
                        /* newSuperior is in same backend */
@@ -363,10 +320,43 @@ do_modrdn(
 
                        goto cleanup;
                }
+
+               /* deref suffix alias if appropriate */
+               suffix_alias( be, &nnewSuperior );
        }
 
        /* deref suffix alias if appropriate */
-       suffix_alias( be, ndn );
+       suffix_alias( be, &ndn );
+
+#if defined( LDAP_SLAPI )
+       slapi_x_backend_set_pb( pb, be );
+       slapi_x_connection_set_pb( pb, conn );
+       slapi_x_operation_set_pb( pb, op );
+       slapi_pblock_set( pb, SLAPI_MODRDN_TARGET, (void *)dn.bv_val );
+       slapi_pblock_set( pb, SLAPI_MODRDN_NEWRDN, (void *)newrdn.bv_val );
+       slapi_pblock_set( pb, SLAPI_MODRDN_NEWSUPERIOR,
+                       (void *)newSuperior.bv_val );
+       slapi_pblock_set( pb, SLAPI_MODRDN_DELOLDRDN, (void *)deloldrdn );
+       slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(1) );
+
+       rc = doPluginFNs( be, SLAPI_PLUGIN_PRE_MODRDN_FN, pb );
+       if ( rc != 0 ) {
+               /*
+                * A preoperation plugin failure will abort the
+                * entire operation.
+                */
+#ifdef NEW_LOGGING
+               LDAP_LOG( OPERATION, INFO, "do_modrdn: modrdn preoperation plugin "
+                               "failed\n", 0, 0, 0 );
+#else
+               Debug(LDAP_DEBUG_TRACE, "do_modrdn: modrdn preoperation plugin "
+                               "failed.\n", 0, 0, 0);
+#endif
+               if ( slapi_pblock_get( pb, SLAPI_RESULT_CODE, (void *)&rc ) != 0)
+                       rc = LDAP_OTHER;
+               goto cleanup;
+       }
+#endif /* defined( LDAP_SLAPI ) */
 
        /*
         * do the add if 1 && (2 || 3)
@@ -381,30 +371,31 @@ do_modrdn(
                if ( !be->be_update_ndn.bv_len || repl_user )
 #endif
                {
-                       if ( (*be->be_modrdn)( be, conn, op, pdn->bv_val, ndn->bv_val,
-                               pnewrdn->bv_val, deloldrdn, pnewSuperior ? pnewSuperior->bv_val : NULL ) == 0
+                       if ( (*be->be_modrdn)( be, conn, op, &pdn, &ndn,
+                               &pnewrdn, &nnewrdn, deloldrdn,
+                               pnewS, nnewS ) == 0
 #ifdef SLAPD_MULTIMASTER
                                && ( !be->be_update_ndn.bv_len || !repl_user )
 #endif
                        ) {
                                struct slap_replog_moddn moddn;
-                               moddn.newrdn = pnewrdn;
+                               moddn.newrdn = &pnewrdn;
                                moddn.deloldrdn = deloldrdn;
-                               moddn.newsup = pnewSuperior;
+                               moddn.newsup = &pnewSuperior;
 
-                               replog( be, op, pdn->bv_val, ndn->bv_val, &moddn );
+                               replog( be, op, &pdn, &ndn, &moddn );
                        }
 #ifndef SLAPD_MULTIMASTER
                } else {
-                       struct berval **defref = be->be_update_refs
+                       BerVarray defref = be->be_update_refs
                                ? be->be_update_refs : default_referral;
-                       struct berval **ref = referral_rewrite( defref,
-                               NULL, pdn->bv_val, LDAP_SCOPE_DEFAULT );
+                       BerVarray ref = referral_rewrite( defref,
+                               NULL, &pdn, LDAP_SCOPE_DEFAULT );
 
                        send_ldap_result( conn, op, rc = LDAP_REFERRAL, NULL, NULL,
                                ref ? ref : defref, NULL );
 
-                       ber_bvecfree( ref );
+                       ber_bvarray_free( ref );
 #endif
                }
        } else {
@@ -413,18 +404,175 @@ do_modrdn(
                        NULL, NULL );
        }
 
+#if defined( LDAP_SLAPI )
+       if ( doPluginFNs( be, SLAPI_PLUGIN_POST_MODRDN_FN, pb ) != 0 ) {
+#ifdef NEW_LOGGING
+               LDAP_LOG( OPERATION, INFO, "do_modrdn: modrdn postoperation plugins "
+                               "failed\n", 0, 0, 0 );
+#else
+               Debug(LDAP_DEBUG_TRACE, "do_modrdn: modrdn postoperation plugins "
+                               "failed.\n", 0, 0, 0);
+#endif
+       }
+#endif /* defined( LDAP_SLAPI ) */
+
 cleanup:
-       free( dn.bv_val );
-       if( pdn != NULL ) ber_bvfree( pdn );
-       if( ndn != NULL ) ber_bvfree( ndn );
+       free( pdn.bv_val );
+       free( ndn.bv_val );
+
+       free( pnewrdn.bv_val ); 
+       free( nnewrdn.bv_val ); 
+
+       if ( pnewSuperior.bv_val ) free( pnewSuperior.bv_val );
+       if ( nnewSuperior.bv_val ) free( nnewSuperior.bv_val );
+
+       return rc;
+}
+
+int
+slap_modrdn2mods(
+       Backend         *be,
+       Connection      *conn,
+       Operation       *op,
+       Entry           *e,
+       LDAPRDN         *old_rdn,
+       LDAPRDN         *new_rdn,
+       int             deleteoldrdn,
+       Modifications   **pmod )
+{
+       int             rc = LDAP_SUCCESS;
+       const char      *text;
+       Modifications   *mod = NULL;
+       int             a_cnt, d_cnt;
+
+       assert( new_rdn != NULL );
+       assert( !deleteoldrdn || old_rdn != NULL );
+
+       /* Add new attribute values to the entry */
+       for ( a_cnt = 0; new_rdn[ 0 ][ a_cnt ]; a_cnt++ ) {
+               AttributeDescription    *desc = NULL;
+               Modifications           *mod_tmp;
 
-       free( newrdn.bv_val );  
-       if( pnewrdn != NULL ) ber_bvfree( pnewrdn );
-       if( nnewrdn != NULL ) ber_bvfree( nnewrdn );
+               rc = slap_bv2ad( &new_rdn[ 0 ][ a_cnt ]->la_attr, 
+                               &desc, &text );
+
+               if ( rc != LDAP_SUCCESS ) {
+#ifdef NEW_LOGGING
+                       LDAP_LOG ( OPERATION, ERR, 
+                               "slap_modrdn2modlist: %s: %s (new)\n", 
+                               text, 
+                               new_rdn[ 0 ][ a_cnt ]->la_attr.bv_val, 0 );
+#else
+                       Debug( LDAP_DEBUG_TRACE,
+                               "slap_modrdn2modlist: %s: %s (new)\n",
+                               text, 
+                               new_rdn[ 0 ][ a_cnt ]->la_attr.bv_val, 0 );
+#endif
+                       goto done;              
+               }
+
+               /* ACL check of newly added attrs */
+               if ( be && !access_allowed( be, conn, op, e, desc,
+                       &new_rdn[ 0 ][ a_cnt ]->la_value, ACL_WRITE, NULL ) ) {
+#ifdef NEW_LOGGING
+                       LDAP_LOG ( OPERATION, ERR, 
+                               "slap_modrdn2modlist: access to attr \"%s\" "
+                               "(new) not allowed\n", 
+                               new_rdn[ 0 ][a_cnt]->la_attr.bv_val, 0, 0 );
+#else
+                       Debug( LDAP_DEBUG_TRACE,
+                               "slap_modrdn2modlist: access to attr \"%s\" "
+                               "(new) not allowed\n", 
+                               new_rdn[ 0 ][ a_cnt ]->la_attr.bv_val, 0, 0 );
+#endif
+                       rc = LDAP_INSUFFICIENT_ACCESS;
+                       goto done;
+               }
+
+               /* Apply modification */
+               mod_tmp = ( Modifications * )ch_malloc( sizeof( Modifications )
+                       + 2 * sizeof( struct berval ) );
+               mod_tmp->sml_desc = desc;
+               mod_tmp->sml_bvalues = ( BerVarray )( mod_tmp + 1 );
+               mod_tmp->sml_bvalues[ 0 ] = new_rdn[ 0 ][ a_cnt ]->la_value;
+               mod_tmp->sml_bvalues[ 1 ].bv_val = NULL;
+               mod_tmp->sml_op = SLAP_MOD_SOFTADD;
+               mod_tmp->sml_next = mod;
+               mod = mod_tmp;
+       }
+
+       /* Remove old rdn value if required */
+       if ( deleteoldrdn ) {
+               for ( d_cnt = 0; old_rdn[ 0 ][ d_cnt ]; d_cnt++ ) {
+                       AttributeDescription    *desc = NULL;
+                       Modifications           *mod_tmp;
+
+                       rc = slap_bv2ad( &old_rdn[ 0 ][ d_cnt ]->la_attr,
+                                       &desc, &text );
+
+                       if ( rc != LDAP_SUCCESS ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG ( OPERATION, ERR, 
+                                       "slap_modrdn2modlist: %s: %s (old)\n", 
+                                       text, 
+                                       old_rdn[ 0 ][ d_cnt ]->la_attr.bv_val, 
+                                       0 );
+#else
+                               Debug( LDAP_DEBUG_TRACE,
+                                       "slap_modrdn2modlist: %s: %s (old)\n",
+                                       text, 
+                                       old_rdn[ 0 ][ d_cnt ]->la_attr.bv_val, 
+                                       0 );
+#endif
+                               goto done;              
+                       }
+
+                       /* ACL check of newly added attrs */
+                       if ( be && !access_allowed( be, conn, op, e, desc,
+                               &old_rdn[ 0 ][ d_cnt ]->la_value, ACL_WRITE, 
+                               NULL ) ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG ( OPERATION, ERR, 
+                                       "slap_modrdn2modlist: access "
+                                       "to attr \"%s\" (old) not allowed\n", 
+                                       old_rdn[ 0 ][ d_cnt ]->la_attr.bv_val, 
+                                       0, 0 );
+#else
+                               Debug( LDAP_DEBUG_TRACE,
+                                       "slap_modrdn2modlist: access "
+                                       "to attr \"%s\" (old) not allowed\n", 
+                                       old_rdn[ 0 ][ d_cnt ]->la_attr.bv_val,
+                                       0, 0 );
+#endif
+                               rc = LDAP_INSUFFICIENT_ACCESS;
+                               goto done;
+                       }
+
+                       /* Apply modification */
+                       mod_tmp = ( Modifications * )ch_malloc( sizeof( Modifications )
+                               + 2 * sizeof ( struct berval ) );
+                       mod_tmp->sml_desc = desc;
+                       mod_tmp->sml_bvalues = ( BerVarray )(mod_tmp+1);
+                       mod_tmp->sml_bvalues[ 0 ] 
+                               = old_rdn[ 0 ][ d_cnt ]->la_value;
+                       mod_tmp->sml_bvalues[ 1 ].bv_val = NULL;
+                       mod_tmp->sml_op = LDAP_MOD_DELETE;
+                       mod_tmp->sml_next = mod;
+                       mod = mod_tmp;
+               }
+       }
+       
+done:
+       /* LDAP v2 supporting correct attribute handling. */
+       if ( rc != LDAP_SUCCESS && mod != NULL ) {
+               Modifications *tmp;
+               for ( ; mod; mod = tmp ) {
+                       tmp = mod->sml_next;
+                       ch_free( mod );
+               }
+       }
 
-       free( newSuperior.bv_val );
-       if ( pnewSuperior != NULL ) ber_bvfree( pnewSuperior );
-       if ( nnewSuperior != NULL ) ber_bvfree( nnewSuperior );
+       *pmod = mod;
 
        return rc;
 }